CVE-2026-82259
Received Received - Intake

SvelteKit Experimental Form Remote Denial of Service

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82259
EUVD
EUVD-2026-67585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sveltekit sveltekit From 2.49.0 (inc) to 2.53.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SvelteKit versions 2.49.0 through 2.53.2. It involves a deserialization expansion issue in the experimental form remote function. When experimental.remoteFunctions is enabled and the form function processes a files array without validating its length or file sizes, attackers can submit small inputs that expand into very large file arrays. This leads to expensive processing and denial of service.

Detection Guidance

Check SvelteKit version with npm list sveltekit or grep dependencies in package.json. If version is between 2.49.0 and 2.53.2, the system is vulnerable. Monitor for unusual CPU or memory spikes during file upload operations.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive server resources. Attackers may exploit it to crash applications or degrade performance, impacting availability. Systems using affected SvelteKit versions with experimental.remoteFunctions enabled are at risk.

Mitigation Strategies

Upgrade SvelteKit to version 2.53.3 or later. Disable experimental.remoteFunctions if not required. Validate file.length and enforce size limits on file uploads. Implement rate limiting for file upload endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart